CSRF fixes

Author: Kiril Kirkov

application/config/config.php

@@ -26,7 +26,7 @@
  */
 
 // add your base url here into the ELSE statement - ''.
-$config['base_url'] = 'http://electronic-invoicing-and-warehouse-management-system.test';
+$config['base_url'] = defined('BASE_URL') ? BASE_URL : '';
 
 /*
   |--------------------------------------------------------------------------
@@ -475,7 +475,7 @@
 $config['csrf_token_name'] = 'csrf_test_name';
 $config['csrf_cookie_name'] = 'csrf_cookie_name';
 $config['csrf_expire'] = 7200;
-$config['csrf_regenerate'] = TRUE;
+$config['csrf_regenerate'] = FALSE;
 $config['csrf_exclude_uris'] = array();
 
 /*

application/modules/admin/views/parts/general/footer.php

@@ -21,7 +21,8 @@ function injectCsrf() {
             }
         }
 
-        document.addEventListener('DOMContentLoaded', injectCsrf);
+        injectCsrf();
+
         document.addEventListener('submit', function(e) {
             var form = e.target;
             if (form.method && form.method.toLowerCase() === 'post' && !form.querySelector('input[name="' + csrfName + '"]')) {

application/modules/users/views/parts/footer.php

@@ -57,9 +57,10 @@ function injectCsrf() {
             }
         }
 
-        // Inject on page load (covers programmatic .submit() calls)
-        document.addEventListener('DOMContentLoaded', injectCsrf);
-        // Also inject on submit event as fallback for dynamically created forms
+        // DOM is already ready here (footer script) — call directly
+        injectCsrf();
+
+        // Fallback for dynamically added forms submitted via submit event
         document.addEventListener('submit', function(e) {
             var form = e.target;
             if (form.method && form.method.toLowerCase() === 'post' && !form.querySelector('input[name="' + csrfName + '"]')) {

application/views/parts/footer.php

@@ -47,6 +47,8 @@ function injectCsrf() {
         }
 
         document.addEventListener('DOMContentLoaded', injectCsrf);
+        // DOM is already ready in footer - call directly too
+        injectCsrf();
         document.addEventListener('submit', function(e) {
             var form = e.target;
             if (form.method && form.method.toLowerCase() === 'post' && !form.querySelector('input[name="' + csrfName + '"]')) {